Eog: eye of gnome: buffer overrun when parsing malicious png files with non-standard iccp chunk
cve-program · CVE-2026-118475
PublishedA flaw was found in Eye of GNOME. When parsing a specially crafted PNG image containing malformed color profile metadata, the application fails to validate chunk boundaries while searching for a null terminator. An attacker could trick a user into opening a malicious image, causing the application to read past the allocated buffer. This issue can lead to an application crash, resulting in a Denial of Service (DoS), or potentially expose sensitive memory contents.
Read the publisher's advisoryAffected versions, risk and source history
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-118475 · CVE overview and exploitation status
cve-program · CVE-2026-118475
Related changes
Linked by CVE identifier- Eog: eye of gnome: buffer overrun when parsing malicious png files with non-standard iccp chunk · Affected-version evidence changed · 6 Nov 2026